Weston 16.0.2 ships with fixes for hardware overlays, RDP auth, and the Lua shell
Wayland's reference compositor gets three targeted bug fixes in its latest point release, no new features included.
Weston 16.0.2 is out, and it's the kind of release you don't always cheer for but are glad to have. It's a point release, which means no new features. But three real fixes get folded into the already-released Weston 16. Maintainer Marius Vlad tagged the build and ran the version bump, noting "a few more useful fixes have landed Weston 16," exactly the kind of phrasing that tells you something important quietly broke and someone moved fast to fix it.
Weston is the reference implementation of a Wayland compositor. That makes it the canonical yardstick for correctness, against which GNOME's Mutter, KDE's KWin, and the wlroots crowd all measure themselves. It also happens to be what embedded and IoT vendors build on, from NVIDIA Jetson to Automotive Grade Linux installs. So when the compositor silently misbehaves on real hardware, the people who care most are the ones shipping set-top boxes and industrial displays, not desktop users fussing over Hyprland themes.
The three fixes
The first touches the DRM backend. Derek Foreman's patch makes the compositor make use of all hardware overlay planes in the system. It fixes a problem where the plane handle list stopped preserving the order of the canonical plane list. When those two diverge, plane selection can skip or misassign overlays and fall back to heavier GPU compositing. On a laptop that barely registers. On a low-power SoC where hardware scanout is the only thing keeping a fan from spinning up like a helicopter, it's meaningfully better.
The second is a security change, and arguably the more interesting one. The RDP backend now refuses to start if the NLA credential database is missing, instead of silently falling back to TLS-only authentication. NLA is the Windows-standard auth that checks the user before a session begins. TLS-only is the weaker option. Configure NLA and the file goes missing, and you'd have silently ended up with weaker auth and no idea it happened. That's a textbook "fail closed" fix. Misconfiguration surfaces at startup instead of quietly downgrading your security posture.
The third lands in the lua-shell, the scriptable shell introduced with Weston 15. Sjoerd Simons' change makes the compositor load Lua modules into the global namespace, so scripts depending on external .lua files can finally require them as intended. It removes a real blocker for anyone building a bespoke shell for an embedded or automotive HMI, and it keeps the lua-shell a genuine extension platform rather than forcing you to write one gigantic self-contained script.
Behind the release
Weston 16.0 dropped on July 14, 2026, bringing HDR and color management, KMS color offload, and a grab bag of DRM backend optimizations. Then 16.0.1 landed on October 19, restoring Intel's i915 driver to the native DRM backend after a regression. 16.0.2 arrives later that October, and the back-to-back cadence isn't a coincidence. Weston sits so deep in the display stack now that a change buried in the DRM subsystem can silently break compositing on newer kernels, which is precisely what the i915 regression demonstrated. These point releases are the only clean path back.
The work comes mostly from the usual suspects at Collabora. Vlad has led Weston's HDR and color roadmap since taking over from Simon Ser. Foreman is the Wayland/Weston release manager. Mateo Ramirez works the RDP backend, and Sjoerd Simons is a long-time libweston contributor.
A release with no new features is easy to dismiss, and I'll grant you that most desktop users shouldn't build this by hand. You're better off waiting for your distro to package it. But for anyone shipping Weston from a distro tree, stability beats novelty every time. Three targeted fixes are worth more than a feature list that quietly introduces new bugs.
The tarball is up on GitLab. It ships with SHA256 and SHA512 sums plus a PGP signature for verification, so check those against the maintainer's key before trusting anything. Weston builds with Meson against current Wayland and wayland-protocols releases, though most people should just install the packaged version.
Head here to download the new release.
